Hi, Eric
I have been dealing with these issues too, and have yet to come up with a good solution. In our AD environment it is happening to existing/established users on their primary workstations - not just on first login. Questions:
Is AD forcing a password change at first login?
Are you seeing popups for the local items keychain, the login keychain, or both?
Since your issue is affecting only first logins, you could script the deletion of one or both keychains and deploy the script with a policy scoped to the the machine and triggered by login with a frequency of "once per user". The problem with deleting the keychains is that it requires an immediate reboot - not exactly an ideal solution. I wonder if their is a way to recreate the keychains without rebooting. If you want to script it you could do something like this:
userName=/usr/bin/who | /usr/bin/awk '/console/{ print $1 }'
LIKC=system_profiler SPHardwareDataType | grep 'Hardware UUID' | awk '{print $3}'
rm -rf /Users/$userName/Library/keychains/$LIKC
The last line deletes the the local items keychain only; if you need to delete login.keychain as well (or instead) you can edit accordingly. Deleting the login keychain is a last resort for me, since it contains wifi certs, etc that have to be re-created. I'm also very curious to hear how others are managing these keychain issues in AD environments.
